Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

Purchase o...df.exe

windows7_x64

10

Purchase o...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase order #282762,pdf.exe

  • Size

    546KB

  • Sample

    200709-9y8tg8cyrn

  • MD5

    ad588deeb9bc85e8bab185d7ae0a3a41

  • SHA1

    78af8c81b8970356368dbb889ed8c1e283c2ee26

  • SHA256

    0067b722606e5742dfa241ea0684189ab4989ab495328a327569027577f8592c

  • SHA512

    3cb271465140a8e2c1111b5da1e50ddfe29970657ddd612764cc74b82bd3d3ee893b90dd071f6c567a81f879863b142abf76580a5a89959c234c0592d106580e

Score
10/10
modiloaderremcospersistencerattrojan

Malware Config

Targets

    • Target

      Purchase order #282762,pdf.exe

    • Size

      546KB

    • MD5

      ad588deeb9bc85e8bab185d7ae0a3a41

    • SHA1

      78af8c81b8970356368dbb889ed8c1e283c2ee26

    • SHA256

      0067b722606e5742dfa241ea0684189ab4989ab495328a327569027577f8592c

    • SHA512

      3cb271465140a8e2c1111b5da1e50ddfe29970657ddd612764cc74b82bd3d3ee893b90dd071f6c567a81f879863b142abf76580a5a89959c234c0592d106580e

    Score
    10/10
    modiloaderremcospersistencerattrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks